Who decides that a business is high risk?
The acquiring bank does, within rules set by the card networks. The provider you apply to is often relaying its acquirer's appetite rather than forming a view of its own, which is why the same business gets different answers from different providers.
Three parties get conflated, and the difference matters when you are deciding what to do after a decline.
The card networks set the outer boundary: the monitoring programmes, the dispute thresholds, the registration requirements for certain categories. These apply to everyone.
The acquiring bank carries the financial risk and sets its own appetite inside those boundaries. Appetite is specific and it moves. A bank that boarded your category last quarter may have filled its exposure and stopped.
The provider or gateway you apply to is frequently neither of those. It passes your application to an acquirer behind it and relays the answer.
This is why the same file can get a yes from one provider and a no from another in the same week with nothing about your business having changed. You are not being measured against a single standard — you are being matched, or not matched, to one bank’s current appetite.
It is also why a decline tells you less than it feels like it does. It is one bank’s answer on one day, not a verdict on the business.